Mirage2FA Phishing Kit Bypasses MFA to Hijack Microsoft 365 Sessions, Targeting 3,500+ Organizations

Researchers tie the LinX Coders phishing-as-a-service toolkit to 9,332 compromise events across 94 countries, with 63.7% of victims in the United States and stolen session cookies accounting for more than half of all outcomes. A phishing-as-a-service (PhaaS) toolkit tracked as Mirage2FA has been linked to the potential compromise of 4,532 Microsoft 365 accounts in a campaign that targeted 3,518 organizations, according to new research published by threat intelligence analysts ShiFu and raptur3 at ANY.RUN. The kit does not drop malware. Instead, it uses browser-executed HTML, XHTML, and SVG attachments to funnel victims to a fake Microsoft login page backed by an adversary-in-the-middle (AiTM) reverse proxy. The proxy relays the username, password, and one-time 2FA code to Microsoft in real time and captures the authenticated session cookie that comes back, letting the attacker enter the account without ever typing a password or completing MFA again. Mirage2FA phishing targets US companies in technology and manufacturing (Source: ANY.RUN) ANY.RUN’s telemetry…